Android.Packed.40409

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.396.origin
Android.DownLoader.576.origin
Android.DownLoader.675.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ff.t####.com.####.com:80
TCP(HTTP/1.1) set####.adz####.com:80
TCP(HTTP/1.1) cale####.a####.communi####.net:80
TCP(HTTP/1.1) cdn.cale####.a####.####.net:80
TCP(TLS/1.0) con####.sm####.jp:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) 1####.217.20.110:443
TCP(TLS/1.0) api.sm####.jp:443
TCP s1.u####.com:7701
TCP k1.yo####.com:7501
TCP k2.yo####.com:7502
TCP k2.yo####.com:7803
TCP k2.yo####.com:7503
TCP k2.yo####.com:7802
TCP s1.u####.com:7703
TCP s1.u####.com:7702
TCP k2.yo####.com:7801

DNS requests:

api.sm####.jp
cale####.a####.communi####.net
cdn.cale####.a####.####.net
con####.sm####.jp
d####.fl####.com
ff.t####.com
k1.yo####.com
k2.yo####.com
k3.yo####.com
p1.i####.com
p2.i####.com
p3.i####.com
s1.u####.com
s2.u####.com
s3.u####.com
set####.adz####.com

HTTP GET requests:

cale####.a####.communi####.net/abtest/weather_ab_test.json
cale####.a####.communi####.net/petacal_fe/public/assets/img/howto/en/how...
cdn.cale####.a####.####.net/cpiad/1.0.0/xml/android/calendar.xml
cdn.cale####.a####.####.net/information/1.0.0/xml/android/calendar.xml
ff.t####.com.####.com/d/44e8.png
ff.t####.com.####.com/d/44eb.jpg
set####.adz####.com/1.1.1314i.json?adtruth_js_collector_version=####&dig...

Modified file system:

Creates the following files:

/data/data/####/.DS_Store
/data/data/####/.FlurrySenderIndex.info.AnalyticsData_PDGYPDCJD...SD_159
/data/data/####/.FlurrySenderIndex.info.AnalyticsMain
/data/data/####/._.DS_Store
/data/data/####/._howto_1.jpg
/data/data/####/._howto_10.jpg
/data/data/####/._howto_2.jpg
/data/data/####/._howto_3.jpg
/data/data/####/._howto_4.jpg
/data/data/####/._howto_5.jpg
/data/data/####/._howto_6.jpg
/data/data/####/._howto_7.jpg
/data/data/####/._widget_howto1.jpg
/data/data/####/._widget_howto2.jpg
/data/data/####/._widget_howto3.jpg
/data/data/####/.flurryagent.-248fd3ca
/data/data/####/.flurrydatasenderblock.03063e78-abef-4a3b-9cab-...20bba0
/data/data/####/.flurrydatasenderblock.151e79de-e19b-41db-b64d-...75b788
/data/data/####/.flurrydatasenderblock.1a6fcdcf-481a-46a1-849e-...3687ea
/data/data/####/.flurrydatasenderblock.25f816a4-705f-40e3-a2b1-...a6be6d
/data/data/####/.flurrydatasenderblock.c86c01db-6af4-4a80-b030-...63acf6
/data/data/####/.flurrydatasenderblock.d04b62bc-7ae4-4ada-a5f6-...7a14e1
/data/data/####/.flurrydatasenderblock.e1a72e82-5267-436c-a64b-...36b783
/data/data/####/.flurrydatasenderblock.e61c134b-f32d-455c-b937-...873953
/data/data/####/.flurrydatasenderblock.e66d228b-81d1-4720-9fc0-...a5c903
/data/data/####/1539774666638o.jar
/data/data/####/1539774666780si.jar
/data/data/####/1539774667007p.jar
/data/data/####/1539774670654o.jar
/data/data/####/1539774670799si.jar
/data/data/####/1539774670895p.jar
/data/data/####/1539774674801o.jar
/data/data/####/1539774674910si.jar
/data/data/####/1539774674997p.jar
/data/data/####/1539774678224o.jar
/data/data/####/1539774678371si.jar
/data/data/####/1539774678455p.jar
/data/data/####/1539774681677o.jar
/data/data/####/1539774681799si.jar
/data/data/####/1539774681896p.jar
/data/data/####/1539774685294o.jar
/data/data/####/1539774685423si.jar
/data/data/####/1539774685519p.jar
/data/data/####/1539774688995o.jar
/data/data/####/1539774689094si.jar
/data/data/####/1539774689184p.jar
/data/data/####/1539774692875o.jar
/data/data/####/1539774693005si.jar
/data/data/####/1539774693087p.jar
/data/data/####/1539774696854si.jar
/data/data/####/1539774696975p.jar
/data/data/####/1539774697191o.jar
/data/data/####/SmartBeat.xml
/data/data/####/YSSensInstallEvent.xml
/data/data/####/YSmartSensor-journal
/data/data/####/__MACOSX
/data/data/####/calendar.db-journal
/data/data/####/calendar_referrer_pref.xml
/data/data/####/calendar_reminder_pref.xml
/data/data/####/com.smrtbeat.xml
/data/data/####/com_cfinc_calendar_prefutil.xml
/data/data/####/common_cpiad_pref.xml
/data/data/####/common_vresionup_pref.xml
/data/data/####/cpiad_info.xml
/data/data/####/fcut_appInfo_pre.xml
/data/data/####/fcut_conf_pre.xml
/data/data/####/fcut_info_pre.xml
/data/data/####/fcut_trategy_pre.xml
/data/data/####/howto
/data/data/####/howto.zip
/data/data/####/howto_1.jpg
/data/data/####/howto_10.jpg
/data/data/####/howto_2.jpg
/data/data/####/howto_3.jpg
/data/data/####/howto_4.jpg
/data/data/####/howto_5.jpg
/data/data/####/howto_6.jpg
/data/data/####/howto_7.jpg
/data/data/####/image_pref.xml
/data/data/####/libSmartBeatNdk.so.bin.5
/data/data/####/notices_list.xml
/data/data/####/partytrack
/data/data/####/partytrack-journal
/data/data/####/partytrack.collector_js
/data/data/####/partytrack.collector_js_version
/data/data/####/partytrack.uuid
/data/data/####/po_download.db-journal
/data/data/####/qcut_download.db-journal
/data/data/####/weather_ab_test.json
/data/data/####/widget_howto1.jpg
/data/data/####/widget_howto2.jpg
/data/data/####/widget_howto3.jpg
/data/data/####/yo_fac_pre.xml
/data/data/####/yo_fconf_pre.xml
/data/data/####/yo_finfo_pre.xml
/data/data/####/yoac_pre.xml
/data/data/####/yoappInfo_pre.xml
/data/data/####/yoconf_pre.xml
/data/data/####/yoinfo_pre.xml
/data/data/####/yop_download.db-journal
/data/data/####/yotrategy_pre.xml
/data/media/####/44e8.png.data
/data/media/####/44eb.jpg.data
/data/media/####/ydistribution_local.txt

Miscellaneous:

Executes next shell scripts:

sh -c echo $PATH

Loads the following dynamic libraries:

SmartBeatNdk
libSmartBeatNdk.so.bin

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial